CVE-2026-39305
CRITICAL SEVERITYCVSS Score & Metrics
Base Score
9.0 / 10
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host. This vulnerability is fixed in 1.5.113.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-22
Source
GitHub
Vendor
pip
Product
PraisonAI
Discussion (0)
Add Comment
No comments yet. Be the first!